Quantum Secret Sharing with Continuous Variable Graph State 
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In this paper we study the protocol implementation and property analysis for several practical 
quantum secret sharing (QSS) schemes with continuous variable graph state (CVGS). For each QSS 
scheme, an implementation protocol is designed according to its secret and communication channel 
types. The estimation error is derived explicitly, which facilitates the unbiased estimation and error 
variance minimization. It turns out that only under infinite squeezing can the secret be perfectly 
reconstructed. Furthermore, we derive the condition for QSS threshold protocol on a weighted 
CVGS. Under certain conditions, the perfect reconstruction of the secret for two non-cooperative 
groups is exclusive, i.e. if one group gets the secret perfectly, the other group cannot get any 
information about the secret. 

PACS numbers: 03.67.Dd, 03.67.Ac, 03.67.Hk 



I. INTRODUCTION 

Quantum cryptography provides a sophisticated ap- 
proach to achieve the communication securityby taking 
advantage of quantum mechanics principles [l| . Among 
various schemes, quantum secret sharing (QSS) is a gen- 
eral multi-partite information security scheme that at- 
tracts extensive research interests ^W,- It allows one 
dealer to distribute a secret among a number of players 
in such a way that a certain set of players can recon- 
struct the secret by taking operations collaboratively and 
exchanging information. In contrast to quantum key dis- 
tribution [lO| that guarantees the secure communication 
between only two parties, QSS enables multiple parties 
to communicate securely at the same time. 

QSS has its origin in classical information theory. An 
early scheme was given in to share either classical 
or quantum secret to three or four players by using the 
GHZ states. Ref. [3 studied general threshold schemes 
to share quantum secrets and showed that the quantum 
no-cloning theorem is the only constraint on the exis- 
tence of threshold schemes. Ref. Q further extended 
the results to general access structures, including non- 
threshold schemes. These researches have established 
theoretical foundations for many ensuing investigations, 
e.g. hybrid schemes [5| and twin-threshold schemes [6|. 

On the other hand, graph state has been extensively 
studied in applications such as quantum error correc- 
tion [ll| - [l4| . entanglement purification p^| - [l7t . entangle- 
ment measurement |18l - [2g | , and Bell inequality 12l|, ^^ . 
In recent years, the implementation of QSS with graph 
state was introduced in [3, [23| to treat three kinds of 
threshold QSS schemes in a unified graph state approach 
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and to propose embedded protocols in large graph states. 
Ref. Is generalized the results to prime dimensions, and 
Ref. [3 investigated non-threshold schemes. However, all 
these results are based on discrete variable graph states. 

Here we are interested in QSS with continuous variable 
graph state (CVGS). CVGS was first introduced in [2J] as 
the continuous analogue of discrete variable graph state. 
It has the nice property that any local Gaussian operation 
on a CVGS can be associated with a geometric transfor- 
mation on its graph representation [25j. Refs. [2a [271 
showed that CVGS can be used to generate universal 
quantum operations and thus is potentially a useful phys- 
ical resource to implement quantum computations. In 
addition, CVGS also finds applications in quantum com- 
munications, e.g. Ref. [28j proposed a protocol to realize 
quantum teleportation between two parties. 

This paper is focused on the implementation and prop- 
erty analysis of QSS schemes with CVGS. We differenti- 
ate eight QSS schemes according to the secret and com- 
munication channel types. Among all these schemes, four 
of them have no practical values because they are either 
physically infeasible or insecure. We will thus investi- 
gate in the other four schemes. These extend the works 
in 0, into the CVGS domain. 

We study two essential problems for these QSS schemes 
with CVGS First, for each QSS scheme, we design an im- 
plementation protocol for the dealer and players so that 
the players may collaborate to estimate the secret. The 
mean and variance of the estimation error are derived 
explicitly. Based on the error statistics, we can derive 
the parameter settings for unbiased estimation. Further- 
more, the protocol parameters can be tuned to minimize 
the error variance. In the case of infinite squeezing, it can 
be shown that finding the condition that a set of players 
can perfectly estimate the secret can be transformed to 
solve a set of linear equations. 

The second problem is the threshold protocol, which is 
crucial for many applications that need decision-making. 
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FIG. 1: QSS (fc,n) threshold protocol 



In QSS, a (fc, n) threshold protocol refers to the case 
when fc players or more can estimate the secret perfectly, 
and any set with less players can never get the secret 
within a finite error bound. We show that an arbitrary 
(fc, n) threshold protocol with n/2 < k < n can be imple- 
mented for three schemes using a weighted CVGS pre- 
pared with infinitely squeezed qumodes. An interesting 
observation is that for the scheme with quantum secret, 
private distribution channel, and quantum player-player 
channel (referred as QPrtQ), the threshold protocol for 
two non-cooperative player groups is exclusive, mean- 
ing that if one group can perfectly estimate the secret 
qumode, the other cannot estimate either quadrature of 
the secret qumode within a finite error bound. The secu- 
rity of the quantum secret is thus gurantteed. For QPrtQ 
and another scheme, these protocols cover all the phys- 
ically feasible cases, and we also reveal the duality be- 
tween them. 

This paper is organized as follows. Sec. |lT| provides 
a brief introduction on QSS schemes and CVGS. Three 
QSS schemes with CVGS are investigated in Sec. illli ITVl 
andFVl respectively. We conclude the paper in Sec. IVII 



II. BACKGROUND 

In this section we give a brief introduction of QSS 
schemes and CVGS. 

In a QSS protocol, there are one dealer and n play- 
ers as shown in Fig. [TJ The dealer has a secret that is 
represented by either classical or quantum information. 
At first, the dealer encodes the secret into a prepared 
quantum state, and subsequently distributes it to all the 
players through either private or public channels. With 
this quantum state at hand, a group of players can either 
apply local operations to their own states and then ex- 
change classical information, or take joint operations to 



their states. The task for these players is to reconstruct 
the secret based on the information circulated around. 

We can classify QSS into eight schemes according to 
their secret type (classical or quantum), dealer-player dis- 
tribution channel (private or public), and player-player 
communication channel (classical or quantum). Among 
all these eight schemes, QPubC and QPrtC are phys- 
ically infeasible because it is impossible to recover un- 
known quantum information from classical information. 
Moreover, QPubQ and CPubQ are insecure because an 
eavesdropper can disguise identity to modify the infor- 
mation on public channel. Therefore, we will investigate 
only the four schemes in Table HI 
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TABLE I: Feasible QSS schemes. 



In particular, we are interested in a [k, n) threshold 
protocol, which refers to the case when it requires at 
least k players to estimate the secret perfectly, and any 
set with less than k players cannot estimate the secret 
within a finite error bound. This procedure is illustrated 
in Fig. m 

In this paper we will use CVGS to implemeirt QSS 
schemes. A CVGS is an entangled multi-qumode state 
that can be represented by an undirected graph. De- 
note the adjacency matrix of this graph as G, whose ele- 
ment Gij represents the interaction gain of the coupling 
between qumode i and j. If Gy takes only binary val- 
ues or 1, it is an unweighted CVGS; otherwise, it is a 
weighted CVGS. 

In a QSS scheme, the dealer needs to prepare a CVGS 
and then to encode the secret into that CVGS. At the 
beginning, the dealer has n vacuum states each with the 
position XI and momentum P^ , where both X^ and 

Pj are random variables with standard Gaussian dis- 
tribution. The dealer then squeezes the momentum and 
at the same time amplifies the position of each qumode, 
obtaining squeezed vacuum states: 



P,^e-^'P^ 



(0) 



Xj = e^'^X 



(0) 



(1) 



Here r-,- is the squeezing parameter for qumode j. Juxta- 
pose A"j's and P^-'s in a vector form: 
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where the subscript [n) indicates the number of the 
qumodes. Now apply a quantum nondemolition (QND) 



coupling with interaction gain Gij to the pair {i,j) [24| . 
This estabUshes a connection between qumode i and j 
in the graph, and the resulting quadratures arc [Xi, Pi + 
GijXj) and {Xj, Pj + GjiXi), respectively. After a series 
of such QND coupling operations, the final quadratures 
can be written as 
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Letting 
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we can rewrite Eq. ([3]) in a compact form as 
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In the next three sections, we will investigate the imple- 
mentations of the CPvtC, QPvtQ, and CPubC schemes 
in Table m We point out that the CPvtQ scheme can be 
implemented by super-dense coding [35[ and is indeed a 
quantum data hiding scheme [36l |37| . Since CPvtQ can 
be dealt with similarly to the others, we will focus on the 
first three. For simplicity, we set h = 1 throughout this 
paper. 



III. CASE 1: CPvtC SCHEME 

In this section we study the CPvtC scheme, in which 
the dealer encodes a classical secret into a CVGS, then 
distributes the qumodes to the players through private 
channels, and finally the players exchange information 
via classical channels so as to reconstruct the secret. We 
will derive the estimation error and then obtain its mean 
and variance. This facilitates the unbiased estimation 
and also the optimal tuning of protocol parameters to 
minimize the error variance. We will also study the con- 
dition to perfectly reconstruct the secret, and discuss the 
implementation of a general threshold scheme on CVGS. 

We now present the implementation details of CPvtC 
scheme. Assume that the classical secret the dealer holds 
is a real number 7. The dealer starts from encoding the 
secret into a CVGS by applying a momentum displace- 
ment operation Z{cjj) = e'^^'*'^ [231 ^^ qumode j with 
quadratures (X- , Pj), where Cj, 7 are real numbers and 
X is the position operator. The momentum of qumode j 
is shifted to P'^ -I- Cjj. Let c = [ ci • • • c„] . Then the 
shifted momenta for all the qumodes can be written as a 
vector cy. The dealer distributes qumode j to player j 
and publishes the vector c to all the players. Now player 
j has the quadratures {X^,Pp + Cjj) under disposal. 

To recover the secret, player j can take the following 
actions: 



pD 
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Pf + c,^. (5) 



Apply the operator cxp -^ — i^^(A^)^ > to the 
quadratures [Xj , P^^ ) so that the new quadratures 



2. Measure the position to get M (Xj + ^P^\ 

where M.{-) is a measurement operation that re- 
sults in a random variable. 



3. Scale the measurement result by a-,- and obtain 
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N = ajM X, + ^P^ 



(6) 



where the last equality is because 7W ( • ) is a linear 
operation. 

The players can then exchange their iXj by classical 
communications. We now show that each player can use 
the sum of /ij as an estimation of the secret 7. From 
Eqs. (H])-®, the estimation error e can be calculated as 
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^M {[a^ + b^G^n) I b^] ^'(„)) + (fc^c- 1)7, 



(7) 



where a = [ai 



[/3i 



PnV, = 



[0 • • • 0] , and G(„) is the adjacency matrix of the 
qumode graph state. 

The mean of the estimation error is 

E e = E 7W ( [a^ + 5^G'(„) | 6^] W(„)) -f (fo'^c - 1)7. 



Since ¥.M{Xj 



KM{Pj 



0, we have 



EM{[a'^ + b'^Gi^n) I &^] V(n)) = 0. Hence, 

Ee= (5^c-l)7. 

To ensure an unbiased estimation, it is only required that 

6^c=l. (8) 

The variance of the estimation error can be obtained after 
some algebraic derivations as 



Td-1 ii2 



Var(e) ^ ||(a^ + b' G(„))i?(„)||^ + ||6^ R-^^\ 



(9) 



where i?(„) = diagje''^ ,■■■ , e'^"}, and || -H is the Euclidean 
norm. 

To enhance the estimation precision, it is desired to 
reduce the error variance ^. Combining with Eq. ([H]), 



it is a nonlinear constrained minimization problem with 
optimization variables a, b, Gin)i s-nd i?(„). We can thus 
tune these protocol parameters to achieve a better es- 
timation. For example, when a, 6, G(n\ are fixed, the 
optimal squeezing parameters that minimize the error 
variance can be chosen as 



"^3 = 77 log 



[qT + bTG. 



{n))j 



(10) 



for bj ^ and (a"^ + 6^G(„))j ^ 0. 

It is also easy to observe that under constraint ([8]) , the 
variance (|9]) can achieve only if some parameters take 
extremal values. One choice is to apply infinite squeezing, 
i.e. letting the squeezing parameters r, — >■ oo and then 



fe^G(„) = 0^. 



(11) 



Combining Eqs. ([8]) and (fTTj). we get a condition that 
guarantees n players to get the secret perfectly under 
infinite squeezing 
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c 
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(12) 



Now let us discuss (fc,n) QSS threshold protocols, 
which means that it requires at least k [k < n) play- 
ers to estimate the secret perfectly, and any set with less 
than k players cannot estimate the secret within a finite 
error bound. Consider a set of k collaborative players 
with indices ji , • • • , jk ■ To simplify the notation, we 
use Aj^K to denote a matrix formed by taking rows with 
indices in J and columns in K from a matrix A, where 
J, K are subsets of A^ = { 1 , • • • ,ti}. For the case of a vec- 
tor, we can similarly define vj. Removing the rows and 
columns corresponding to the remaining n — k players 
from Eq. (|12p . we obtain 



V '^J 



Ij,N 
Gj.N cj 
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(13) 



where J = {j'l, • • • ,jk}- Eq. ()13p is a sufficient and nec- 
essary condition for k players from a set of n players to 
recover the secret perfectly under infinite squeezing. 

We give a lower bound on k that ensures the physical 
existence of a (fc, n) CPvtC threshold protocol. 

Theorem 1 A (fc, n) threshold protocol of CPvtC 
scheme satisfying n/2 < k < n can be implemented on a 
weighted CVGS with infinite squeezing. 

To keep the flow of the paper, the proof is given in Ap- 
pendix 13 



IV. CASE 2: QPvtQ SCHEME 

In this section we discuss the QPvtQ scheme, in which 
the dealer has a quantum secret, the qumodes encoding 



the secret are distributed through private channels, and 
the players share their information by quantum commu- 
nication channels. We will first give the implementation 
protocol design, and then calculate the estimation error. 
We then discuss the condition of perfectly estimating the 
secret qumode as well as the threshold protocols under 
infinite squeezing. 

First consider the protocol design. In a QPvtQ scheme, 
the dealer has a secret qumode {Xs,Ps)- At the be- 
ginning, the dealer prepares an {n + l)-mode CVGS, 
and keeps the (n + l)-th qumode with quadratures 
{X^^l,P^_^_l) for later use. The dealer distributes the 
other n qumodes to the n players. Now the dealer per- 
forms a Bell measurement as follows. First, combine 
the (n -f l)-th qumode with {Xs,Ps) to yield two new 
qumodes (Xu,P'u) and (Xy,Py), where 



X-,, — 



^n+l + ^S 



^/2 



Xy 



X^+1 - Xs 



V2 



Pu = 

p,^ 



P^+1 + Ps 

PS+i - Ps 
V2 ■ 



(14) 



Second, take homodyne measurements for X^ and Py. 
The measurement results M.{Xy) and M{Py) are two 
Gaussian random variables. 

The dealer publishes these two measurement results 
to all the players. If any set of players can construct 
the qumode (— AT^^.]^, P,^]^), they can perfectly estimate 
the secret by simply adding the position displacement 
v2A^(A„) and subtracting the momentum displacement 
^/2^A{Py) [23] • This is the idea of continuous variable 
quantum teleportation [3C| . 

To construct {— X'^^t^, P^_^-^) , the players can take the 
following steps: 

1. Apply a single-mode Gaussian unitary opera- 
tion and a phase insensitive amplification 31 1 
to transform a qumode (A'^,P^) to (a^Ap -|- 
l3jP°,a'jXf -h /3jif ), where a,, (3^, a^, pr are all 
real numbers; 

2. Pick one qumode from the players' qumodes and 
transform it to (^^^^ a,Af + /3,Pf , Y.7=i "^-^f + 
P'jPj^) by using nonlocal operations such as a 
controUed-X operation [33 ■ 

From Eq. (|3]), the position error can be calculated as 
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where a 
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,A„+i,Pi,--- ,P„+i]^, andG(„+i) is an {n+l)x 



(n + l) adjacency matrix. Similarly, the momentum error 
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W(n+1), 

(16) 



where a' = K, • • • ,a'J^, b' = [P[,--- ,l3'J^, and 5^+1 
is the (?7 + l)-th row of the matrix G(„_|_i). 

By applying local unitary operations, the covariance 
matrix of the secret qumode can be diagonalized to 

/var(Xs) \ 

1^ Var(Ps)y 

From Eq. (1) in [33|, we can get the fidelity of the esti- 
mated secret qumode as 



F = 



vr- 



(17) 



where 
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In particular, for minimum uncertainty states, we have 
that Var(Xs) Var(P5) = 1. Hence e = 0, and Eq. ^ 
can be simplified to 



F 



2 

T5' 



(18) 



With the fidelity in Eq. ([T7| . it is possible to opti- 
mize the protocol parameters to maximize the fidelity. 
To achieve perfect fidelity at 100%, it is required that 
1^1 = V2 = 0. This amounts to the following conditions 
under infinite squeezing: 



[[a^l] + [6^0]G(„+i)] =0^, 
[[a'^0] + [fe'^0]G(„+i)-ffJ+i] 



(19) 
(20) 



Eqs. (1191) and ([20]) can be rewritten as 



[J I b^] 
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9 n+l J 
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(21) 
(22) 



where /', G'^^ , j^-, are n x (n+l) matrices obtained by 
deleting the (n+ l)-th row of the matrices / and G(„_|_i), 
respectively. 

Next we study the threshold protocol for QPvtQ 
scheme. The following theorem can be obtained. 

Theorem 2 Any {k,n) threshold protocol of QPvtQ 
scheme can be implemented with a weighted CVGS of 
infinite squeezing. 

The proof is given in Appendix iBl 

Furthermore, different from CPvtC, if these k players 
can perfectly recover the secret, we can show that the 
remaining n—k players cannot get any information about 
the secret. 

Theorem 3 For two non-cooperative group with QPvtQ 
scheme, if one group can perfectly estimate the secret 
qumode, the other group cannot estimate either quadra- 
ture of the quantum secret within a finite error bound. 
Thus they cannot obtain any information about the se- 
cret. 

The proof is provided in Appendix [Cj 

For a (fc, 2fc — 1) threshold protocol, since any group 
with k or more players can perfectly estimate the secret, 
from Theorem [3l we know that any group with less than 
k players can obtain no information about the quantum 
secret. This holds true for any (fc, n) threshold protocol, 
which is obtained from (fc, 2k — 1) protocol by picking n 
qumodes from 2k — 1 qumodes. For these protocols, we 
have the following corollary. 

Corollary 1 Any player group with number less than 
the threshold k cannot obtain any information about the 
quantum secret. 



V. CASE 3: CPubC SCHEME 

This section is focused on the CPubC scheme, where 
the dealer has a classical secret, the qumodes encoding 
this secret is distributed through public channels, and the 
players collaborate to get the secret by classical commu- 
nication channels. We will propose an implementation 
protocol, and then calculate the estimation error. The 
threshold protocol is studied by revealing the duality be- 
tween QPvtQ and CPubC and schemes. 

We start from proposing the implementation protocol. 
First, the dealer prepares an (n + l)-mode CVGS, keeps 



the {n + l)-th qumode, and then distributes the other n 
qumodes to the n players. Since the qumodes are dis- 
tributed through public channels, there exists risk that 
some eavesdroppers may get them. To ensure secure clas- 
sical communications, from the method of CV quantum 
key distribution [lO[, the dealer takes a random homo- 
dyne measurement at the {n + l)-th qumode and obtains 
either Ai{X^_^_l) or M{P^_^i). Here the dealer measures 
either the position or the momentum, but which quadra- 
ture has been measured is unknown to the others. The 
measurement outcome is then used as a random key that 
the dealer will share with the players. 

Secondly, the players achieves a consensus via classical 
communications that they will randomly estimate either 
Ai{X^_^_i) or Ai{Pn+i) in a collaborative manner. Then, 
they take the three steps of Eqs. ([S])-® as in Sec. IIIIl 
and exchange their results so as to use X^^i ■^i'^j-^j + 
PjPp) as an estimation of the secret. 

Thirdly, both the dealer and the players need to make 
sure that the quadrature they estimated is exactly the 
same as the one that the dealer measured earlier. The 
dealer and the players will do the following: 

1. The players announce the quadrature that they es- 
timated; 

2. The dealer publishes the quadrature actually mea- 
sured; 

3. If the quadrature estimated by the players matches 
the one measured by the dealer, they keep the esti- 
mation result X^iLi ■^{<^j^j+f^jPj') s-s the shared 
key; if not, they discard it and try again. 

Step 3 is necessary because if the estimation quadra- 
ture matches the measurement quadrature, the players 
obtain an unbiased estimation of the measurement out- 
come. Otherwise, the players get something completely 
useless. The error in this case will be unbounded, as 
a homodyne measurement for the position (or momen- 
tum) will collapse the momentum (or position) into a 
maximally uncertain state. This completes the protocol 
implementation. 

Next we calculate the estimation errors for both 
quadratures. If the players have estimated ^4{X^_^_l), 
the position estimation error is 



e^ =M [a^ b^ O] 

=Al([[a^-l] + [5^0]G(„+i)|[6^0] 
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The variance achieves only when the qumodes are in- 
finitely squeezed and the following equation holds true: 

[a^-l] + [5^0]G(„+i)=0^. (25) 



Eq. ((25|) can be rewritten as 
[a^ I b^] '' 
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(n+l) 



[0^ I 1]. 



(26) 



If the players have estimated M{P^_^i), the momen- 
tum estimation error is 

ep (27) 



^M 



The error Cp also has zero mean and we again have an 
unbiased estimation. Its variance is given by 



a'^ b'^ 0] 
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M fTjG \ 
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-1] 


V n+lj 

(28) 



Var(ep) = || [[a'^ 0] + [b'^ 0]G' - ^T+i] R' 
+ ||[6'^-l]i?'-if . 



(29) 



To make the error variance equal to 0, we need the infinite 
squeezing together with 

[[a'^0] + r0]G'-.gJ+J=O^, (30) 

which yields that 
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Finally, we discuss the threshold protocol of CPubC 
by revealing the duality between QPvtQ and CPubC 
schemes. We now show that under infinite squeezing, a 
(fc, n) threshold protocol can be implemented on CPubC 
if and only if it can be implemented on QPvtQ. We have 
proved that in CPubC scheme the existence of a set of 
players who can perfectly estimate the secret is equivalent 
to the consistency of Eqs. ([25]) and (pij) . and in QPvtQ 
scheme that existence is equivalent to the consistency of 
Eqs. dHI and ^. It is clear that Eqs. ^ and ^ are 
the same, and Eq. (|21|) differs from Eq. (|26|) only by a 
sign. Thus the existence of a {k, n) threshold protocol on 
CPubC is equivalent to that on QPvtQ. Similar results 
for the discrete variable were given in |34{ . Furthermore, 
from Theorem [21 a (fc,n) threshold CPubC protocol ex- 
ists if and only if n/2 < k < n, and all these CPubC 
protocols can be implemented using weighted CVGSs. 



It is easy to see that the error has zero mean and we have 
an unbiased estimation. The error variance is given by 



Var(e,) = || [[a^ -1] + [6^0]G(„+i)] R'\ 



[b^ 0]R 



/-I I 



(24) 



VI. CONCLUSION 

This paper investigated three QSS schemes with CVGS 
in details, namely, CPvtC, QPvtQ, and CPubC. We de- 
signed implementation protocols for each scheme, and 



derived analytic formula for the estimation error. This 
makes it possible to minimize the error variance by vary- 
ing protocol parameters. We also showed that a (k, n) 
threshold QSS protocol of the three schemes satisfying 
n/2 < k < n can be implemented by using a weighted 
CVGS with infinite squeezing. These protocols cover all 
the physically feasible threshold protocols for QPvtQ and 
CPubC. Specifically, the perfect estimation for two non- 
cooperative groups on QPvtQ is exclusive. Finally, the 
duality between QPvtQ and CPubC schemes is discussed. 
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Appendix A: Proof of Theorem [T] 

To guarantee all the {k,n) threshold protocols with 
n/2 < k < n can be implemented, the dealer only need 
to make sure that they can implement the case when n = 
2fc — 1. In (fc, 2fc — 1) threshold protocols, any k players 
can cooperatively get the secret. Even if less than k of the 
2k — I qumodes are removed, any k players holding the 
reserved qumodes can still obtain the secret. Hence, by 
choosing arbitrary n players from the total 2fc — 1 players, 
a {k, 2fc— 1) threshold protocol can be transformed into a 
(/c, n) protocol. Thus, to prove Theorem[Tl we only need 
to show that any (/c, 2k— 1) protocol can be implemented 
using a weighted CVGS of infinite squeezing. 

Suppose that in a communication system with one 
dealer and 2k — 1 players, a set of k players collaborate to 
reveal the secret. Since Eq. (fT3|) is a sufficient and neces- 
sary condition for the k players to perfectly estimate the 
secret, to guarantee they can get the secret, it is required 
that Eq. ^ with n = 2k-l has solutions. In Eq. (fTS]) . 
the 2k X 2k matrix 



Ij,N 

Gj,N Cj 



maps a 2A:-dimensional vector 

dimensional nonzero vector [0 • 

{ji,--- ,jk} and N = {!,■■■ ,2k 

full rank, there exists exactly one solution [oj 5j]. Since 

the submatrix Jj^at is always full rank, we only need to 

guarantee the submatrix [Gj^k cj] is full rank, where 



aj 65"]^ to a 2k- 

■ 1]^', where J = 

1}. If this matrix is 

T lTi 



K — N \ J. This condition can be satisfied by design- 
ing the adjacency matrix G and the vector c. Here the 
backslash denotes the set difference. 

To show that it is a {k,2k — 1) threshold protocol, 
we also need to prove that any subset with fewer than 
k players cannot estimate the secret within a finite error 
bound. Indeed, we only need to prove there is no solution 
to Eq. (fT^ if k is replaced by fc— 1. In this case, Eq. IT; 
becomes 



V "J' 



Ij',N 

Gj'N Cj' 



••• 1 



(Al) 



where J = {Ji,--- ,Jk-i}- Consider the first 2k — 1 
columns of the matrix in Eq. (JA1[) . The submatrix 

Gj'.N 

maps [a^, 6j/] to a (2fc—l)-dimensional zero vector. Since 
the submatrix is full rank, [oj, b'j,] can only be a zero 
vector, which contradicts the fact that b^,cj' = 1. So 
Eq. (|A1[) has no solutions. Hence the theorem is proved. 



Appendix B: Proof of Theorem [2l 

From quantum no-cloning theorem, we know that a 
{k, n) threshold QPvtQ protocol must satisfy n/2 < k < 
n. The largest possible value of n is 2k — 1. In this case, 

[/'"'" I G""^] is a 2?! X (n + 1) matrix. Since there are 
2(n — k) zeros in [a'^ | b'^], only a, 2k x 2k submatrix 
[(/j)^ {Gj^n)'^]'^ needs to be considered in Eqs. ((2T|) 
and ((221). If this matrix is fuU rank, both Eqs. ((2T|) 
and (|22p have a unique solution. The matrix Ij is al- 
ways full rank, thus to make [{Ij)'^ {Gj^n)'^]'^ full rank, 
we need to the k x k submatrix Gj^k to be full rank as 
well, where K = N \ J. 

If for any k players, the corresponding Gj^k is full 
rank, this CVGS can be used to implement a {k, 2k — 1) 
threshold QPvtQ protocol. We can always find a proper 
weighted CVGS satisfying this condition. If {k,2k — 1) 
protocols are obtained, the dealer can implement any 
(k, n) protocol by picking n qumodes from a {2k — 1)- 
mode CVGS and distributing to n players. 



Appendix C: Proof of Theorem [3] 

Divide n players into two groups: one has k players 
and the other n — k players. We need to show that if one 
group can perfectly estimate the secret qumode {Xs, Ps)i 
the other group cannot estimate either Xs or Ps within 
a finite error bound. If we can prove it is impossible that 
one group perfectly estimates Xs when the other group 
perfectly estimates Ps, the theorem is proved because 
any nonzero estimation error must be unbounded under 
infinite squeezing. 



If the group with k players can collaborate to estimate 
the position distribution of the secret qumode perfectly, 
we have 



(CI) 



where M = {1, • • • ,n + 1}, and J is a fc— subset of N 
{1, • • • ,n}. From Eq. (|C1|) . we obtain 



«5 bi 




Ij,M 
Gj^M 


= 


0T^ -1 



bjGjM\j 



oLfc -1 



(C2) 



Denote the last column of Gj,m\j as vi. 

For the other group, if they can collaborate to estimate 
the momentum distribution of the secret mode, we get 



^K "K 



Ik,m 
Gk,m 



_ T 
— .9n+lJ 



where K = N \ J. We then have 
^kGk,? 



"2 J 



(C3) 



(C4) 



where P = M \ K and V2 = {gn+i)p (recall that gn+i 
is the last column of G'(„+i)). Hence V2 = [vf 0]. Since 
Gj^N — [G,iK vi], we can rewrite Eqs. (|C2[) and (|C4p as 



^K 



Gjji vi_ 
Gk.j V3 



i — k 



(C5) 
(C6) 



where V3 is the last column of Gk,p- From Eq. (|C6[) . we 
have vf — b^GK,j- Substituting it into Eq. (|C5|) . we get 



bjGj,K[I 



'JK 



[ol 



1], 



which is a contradiction. Thus, it is impossible for one 
group of players to perfectly estimate the position dis- 
tribution, and the other to estimate the momentum dis- 
tribution, if these two groups do not have any quantum 
communication. 
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